Vulnerability Details CVE-2024-56916
In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticated attacker can leverage this to add malicious JavaScript to the any banner field. Once a victim edits a Configuration History version or attempts to Add a new version, the XSS payload will trigger.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 9.2%
CVSS Severity
CVSS v3 Score 6.1
References
Products affected by CVE-2024-56916
-
cpe:2.3:a:netbox:netbox:4.1.10
-
cpe:2.3:a:netbox:netbox:4.1.11
-
cpe:2.3:a:netbox:netbox:4.1.7
-
cpe:2.3:a:netbox:netbox:4.1.8
-
cpe:2.3:a:netbox:netbox:4.1.9
-
cpe:2.3:a:netbox:netbox:4.2.0
-
cpe:2.3:a:netbox:netbox:4.2.1